From nobody Sat Jul 25 02:11:08 2026 Received: from mail-pj1-f46.google.com (mail-pj1-f46.google.com [209.85.216.46]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5F6AD43E070 for ; Mon, 20 Jul 2026 16:22:28 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.46 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784564554; cv=none; b=s3obwpD7BxzCnLPmb/+92O+DroTkqyqtn0v1E9D+sBG7F2t6QYupINdt92/e4xt027Nm7nsklNm0vyjWyl+4Y1vI/qJWlnPg+jRndAkE4ESSdnRogh2WKIoqAh2YRgNHj6weh9ebNA5rAog0lGIuDl20HasERX2oDB9COOxNjS8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784564554; c=relaxed/simple; bh=hrwbKfjxfMBHDEnyvfS7f8dzT8Uiy7UNqBhL2l9L0MU=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=PYnrWmUHWb0Ahvg7kNm5KO9QCmW9QgmOJr7NBy/8SiyDreddvGCT4tetI1pm2B5n/SdsJV44PbKi5hGcxxoH4Ise1kD4qzkJDd0JKSVurHwpcvBjifn+zgewuoYbC87cn/PPdifkiE/U+jB6J6GkBvUPKrwy+kW+rL14FvUjnXQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=debian.org; spf=pass smtp.mailfrom=gmail.com; arc=none smtp.client-ip=209.85.216.46 Authentication-Results: smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=debian.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Received: by mail-pj1-f46.google.com with SMTP id 98e67ed59e1d1-38dd55ad76cso3099822a91.1 for ; Mon, 20 Jul 2026 09:22:27 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784564546; x=1785169346; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=El2S4HNy2F3ZJ9jMldpD2oKA7qs4fNQFyEGd7Ijf3bs=; b=G41XOwmnfM+XwenXPESFdXEoESxMhPQxxF2X/Cm4yFf8RgbeTJ61f44/GTmzSqRMdY x3q9G4fBQobEDEoo0zgMiTYHYNegkd8Q4IZvwvgdoLOGOFeJFx9qcq3+uAN4o9TvPp+j d/OCG2j90+tWd0QBX/J5Ubfy5Oe7jV0oefRMUC+L2ZfbQn6QHCuRDIcDhuWwoLzdDygf tBAWjZMke3dV+Gu/fQp4F0/ApxMtQlg2/xIFye2OyROiYorx3oNuv9zvOOcMkgCKZoLt 0Mzok70FrUGRfnOl2axzypmNQrlC4DLve1HxvoC4mAJIyMxXGB2s0Tst61Lqgb7uMPw/ jwdA== X-Forwarded-Encrypted: i=1; AHgh+RqwvvLKMOx9/GEKlQfPJBrztIhhk6ex67KzFMThufdNJ4qe4itRwPgJJkj5jBvSKcQszVVQ8hnmn8FYjBw=@vger.kernel.org X-Gm-Message-State: AOJu0YzcFfP48p59fvTFS1m6Me5DGZniM6i6+7gEvMWfbd31zHTlaSy4 BTAaMgrvgMTsz62Rg9uhtGr/+OrXBlOfxrlShly6rNN2LEGJF9lYUn0= X-Gm-Gg: AR+sD10RtlHhH1qFi3bsCYViKNFbDQFWIRqvukVSWWTnVT25W5XgjziJUb25a3yvFGz ZT5XM//vJMZoDGGNh05rI33Sp/CUU8yLYYB5yDuEceZ+dloiueldNcaitpCtLQLynctuz4bAagk qCG9I1KvJyeYhkP785amW8L2J4ucaLaQOwEzBgqPXhGMcfu8PiBYaDviHSUrc4D4Swl83KuPCPV FB6J914+txDoRjx3wgL1eBZ528PGAVpE6QtueqckjsEF+j6Xi5iwR47FzTTnOZENHeiTqZQoVbZ l798PJRxovSKkrZqgp93tkIFWZ5DjnYUdJy35DGjYVpNeERXjLcBuB4lR558/SB1pwbL+z73ULM YphooqAJmU+dbsqoI/m54chHACfKQTf2rlrVHbD6BEU8lTduBEYGnPdSZVUY+8497HEymIiMxNS KAwx57gpHkHEvKjFsAPqmFKe4N1B3OX/qO4VjnlAnn/LefbTssOo1WB2bSY00IUpc9wM7O7hQsE w24s/8JDroB77yr2A== X-Received: by 2002:a17:90b:2547:b0:36d:c138:e0a0 with SMTP id 98e67ed59e1d1-38e4b4d4429mr13461842a91.2.1784564545891; Mon, 20 Jul 2026 09:22:25 -0700 (PDT) Received: from penguin.tail0a1999.ts.net (61-228-16-100.dynamic-ip.hinet.net. [61.228.16.100]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-38e9205d358sm29366a91.3.2026.07.20.09.22.24 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 20 Jul 2026 09:22:25 -0700 (PDT) From: Shih-Yuan Lee To: Dmitry Torokhov Cc: Mark Brown , linux-input@vger.kernel.org, linux-kernel@vger.kernel.org, Shih-Yuan Lee Subject: [PATCH v3 1/5] Input: applespi - use unified wait queue with timeouts for drain Date: Tue, 21 Jul 2026 00:22:15 +0800 Message-Id: <20260720162219.32324-2-fourdollars@debian.org> X-Mailer: git-send-email 2.39.5 In-Reply-To: <20260720162219.32324-1-fourdollars@debian.org> References: <20260720162219.32324-1-fourdollars@debian.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Consolidate wait queues by renaming drain_complete to wait_queue and use wait_event_lock_irq_timeout() with a 3-second timeout during read and write drains to prevent indefinite lockups during driver unbind or PM transitions if the hardware becomes unresponsive. If a timeout occurs while a read or write transfer is still active, issue a warning and fallback to waiting unconditionally until the transfer comple= tion callback clears the active flag. This guarantees that applespi_drain_writes= () and applespi_drain_reads() never return prematurely while transfers are in = flight, preventing use-after-free (UAF) and DMA memory corruption when devres frees the driver context and DMA buffers during unbind. Signed-off-by: Shih-Yuan Lee --- drivers/input/keyboard/applespi.c | 48 ++++++++++++++++++++++++------- 1 file changed, 38 insertions(+), 10 deletions(-) diff --git a/drivers/input/keyboard/applespi.c b/drivers/input/keyboard/app= lespi.c index b5ff71cd5a70..c501bf7e517e 100644 --- a/drivers/input/keyboard/applespi.c +++ b/drivers/input/keyboard/applespi.c @@ -417,7 +417,7 @@ struct applespi_data { =20 bool suspended; bool drain; - wait_queue_head_t drain_complete; + wait_queue_head_t wait_queue; bool read_active; bool write_active; =20 @@ -677,7 +677,7 @@ static int applespi_setup_spi(struct applespi_data *app= lespi) return sts; =20 spin_lock_init(&applespi->cmd_msg_lock); - init_waitqueue_head(&applespi->drain_complete); + init_waitqueue_head(&applespi->wait_queue); =20 return 0; } @@ -725,7 +725,7 @@ static void applespi_msg_complete(struct applespi_data = *applespi, applespi->write_active =3D false; =20 if (applespi->drain && !applespi->write_active) - wake_up_all(&applespi->drain_complete); + wake_up_all(&applespi->wait_queue); =20 if (is_write_msg) { applespi->cmd_msg_queued =3D 0; @@ -1415,7 +1415,7 @@ static void applespi_got_data(struct applespi_data *a= pplespi) applespi->read_active =3D false; applespi->write_active =3D false; =20 - wake_up_all(&applespi->drain_complete); + wake_up_all(&applespi->wait_queue); } =20 return; @@ -1793,21 +1793,49 @@ static int applespi_probe(struct spi_device *spi) =20 static void applespi_drain_writes(struct applespi_data *applespi) { - guard(spinlock_irqsave)(&applespi->cmd_msg_lock); + unsigned long flags; + long ret; + + spin_lock_irqsave(&applespi->cmd_msg_lock, flags); =20 applespi->drain =3D true; - wait_event_lock_irq(applespi->drain_complete, !applespi->write_active, - applespi->cmd_msg_lock); + ret =3D wait_event_lock_irq_timeout(applespi->wait_queue, + !applespi->write_active, + applespi->cmd_msg_lock, + msecs_to_jiffies(3000)); + if (!ret && applespi->write_active) { + dev_warn(&applespi->spi->dev, + "Timed out waiting for write drain, waiting unconditionally\n"); + wait_event_lock_irq(applespi->wait_queue, + !applespi->write_active, + applespi->cmd_msg_lock); + } + + spin_unlock_irqrestore(&applespi->cmd_msg_lock, flags); } =20 static void applespi_drain_reads(struct applespi_data *applespi) { - guard(spinlock_irqsave)(&applespi->cmd_msg_lock); + unsigned long flags; + long ret; =20 - wait_event_lock_irq(applespi->drain_complete, !applespi->read_active, - applespi->cmd_msg_lock); + spin_lock_irqsave(&applespi->cmd_msg_lock, flags); + + ret =3D wait_event_lock_irq_timeout(applespi->wait_queue, + !applespi->read_active, + applespi->cmd_msg_lock, + msecs_to_jiffies(3000)); + if (!ret && applespi->read_active) { + dev_warn(&applespi->spi->dev, + "Timed out waiting for read drain, waiting unconditionally\n"); + wait_event_lock_irq(applespi->wait_queue, + !applespi->read_active, + applespi->cmd_msg_lock); + } =20 applespi->suspended =3D true; + + spin_unlock_irqrestore(&applespi->cmd_msg_lock, flags); } =20 static void applespi_remove(struct spi_device *spi) --=20 2.39.5 From nobody Sat Jul 25 02:11:08 2026 Received: from mail-pj1-f51.google.com (mail-pj1-f51.google.com [209.85.216.51]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3B17F43D4FE for ; Mon, 20 Jul 2026 16:22:30 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.51 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784564558; cv=none; b=SxweyCMtwgzvL4guPS0Kr3yrLAh5phvJtyC4Xi4oYDsKBHYsWHZY5IsxMzT3fuTqI/0oTfqJ0nNJ9P12Y28xArFih6sOqIvboMQWdLIMCix+ZEzGo3nZfNahzzFDStY7yku0e4j6tFACZyFrTfuwKCBR4w75Qn7fEHRQVWvY2g0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784564558; c=relaxed/simple; bh=zy4q27u28EugEL37kMmqTNjOTMm3mvjNDOjY1JWr3Xc=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=S6sUE+yMwRHYMRsUhAPJK3AvwY0M/1N4WanXuOjZ/+VAEb3p+M5Sw9jX+haG648sMtRkmc0Fbe2ACSbeXjEcdTA2Dg4VWTy1SFRSalVnzo9RZHR+9JGVYgvMNZYakf9fuTYMe9R+9MRBNaSd2sj/0BaXStBboj9xnyd2A8NR51Y= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=debian.org; spf=pass smtp.mailfrom=gmail.com; arc=none smtp.client-ip=209.85.216.51 Authentication-Results: smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=debian.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Received: by mail-pj1-f51.google.com with SMTP id 98e67ed59e1d1-38e3617ba36so4692576a91.3 for ; Mon, 20 Jul 2026 09:22:30 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784564548; x=1785169348; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=l/cxff2lJvCCxKqfkd39UqOApEAlOgurgz84vO2zlLo=; b=j9eycJ40NgigPz3aZ96WaTosJKjw2Em5lt5jWuN7hVJqHT/s9/QzaGnXLs2r51QgCf dHqJhPeTShIXVySdB4TJSlhPcQTnCwqWxYzB6vf+LroSN4a1kZ7vLYCjooAa51qg5E4A 2nWFeONWEmh4dFUwJnBleNZSq/rbLXXk2x8W+YETko4aQiqLXc2kFkOqMM5K/N859+ji Mh8da3MpYgRAVBt7LzJ7Cohj44vksN6iQeofVs1apZiCim62mhGQ3bwEYfJ/k+A2G/gV HuiyXXkDTUQXrfpqw5edBrG2BmrZ2T+sDsgL+NaLzATP9/U13eyd0PLGkT9Tu7lZANRC JQrw== X-Forwarded-Encrypted: i=1; AHgh+RrHfPJxZe5neXXYr7bllsL12fMVM5P0OjGWs6hp+5UflPoeN3L5TJofBUR17VVtp47NFotpjH1Axi397/I=@vger.kernel.org X-Gm-Message-State: AOJu0YziZcn0urLdqd/QTqx4nJxtyvTRfcxkHnPyjXgBe4CuYihFQ5DC +MqQlWtuLeMCCBzfHDa56Xcg52Qmg7crjPRbwDFFOBRsoUAle/NiF34PgNcwPICYRA== X-Gm-Gg: AR+sD11Jk4mhCN3Wo0Z10G18J107KUUZ+2dmPOEhIklKN79R3djTe4PAANUZ23iNLgC Lc/azKXSPmg4/UpsIv05Jxb7w/4wUcGE8f5cyxp01GQ5gyxGKzH8nyFRV1L0u8GJpE9raUO2Y1Y ex8SN3a+TSbLcVqpxXGpIdvLg10uIQeIi1347fzNO356GNH9wSBm9qe4TvmFrlN022eRytjR/06 eBfJu8BLPhXgIMJnNDrG7quZ+mBywmENzN0dh+hLqnV1E9fbj14vOkYaCmA7CHtxaYWUMhxXHbx pFx1osx39z/kKOUVDHp2Wd8N0aE01F62LJZaZPR9xCkE3gAl/QXVrUk0LqkWTocYdAVzMHwDlO1 0BSxaWdLWYi5TGCHLOjVuKQn77/iaVgM+4/AsICJPqKcw9nklGHnDNCA5qEqm3Kg01Lt/TntW5U yEzDNNRthGWbHWrQuYaMxxnXJ+4EzROi1kYYrw4wEk+prk3RZPmy8iTwyJ8BDryHJyy4IYbuMTd XjeUom4BHawqTsKag== X-Received: by 2002:a17:90b:1d0b:b0:38e:76f8:fcb1 with SMTP id 98e67ed59e1d1-38e76f91c4bmr6456556a91.32.1784564547618; Mon, 20 Jul 2026 09:22:27 -0700 (PDT) Received: from penguin.tail0a1999.ts.net (61-228-16-100.dynamic-ip.hinet.net. [61.228.16.100]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-38e9205d358sm29366a91.3.2026.07.20.09.22.26 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 20 Jul 2026 09:22:27 -0700 (PDT) From: Shih-Yuan Lee To: Dmitry Torokhov Cc: Mark Brown , linux-input@vger.kernel.org, linux-kernel@vger.kernel.org, Shih-Yuan Lee Subject: [PATCH v3 2/5] Input: applespi - track asynchronous SPI transfers in flight Date: Tue, 21 Jul 2026 00:22:16 +0800 Message-Id: <20260720162219.32324-3-fourdollars@debian.org> X-Mailer: git-send-email 2.39.5 In-Reply-To: <20260720162219.32324-1-fourdollars@debian.org> References: <20260720162219.32324-1-fourdollars@debian.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The driver queues read and write packets asynchronously. When shutting down, removing, or suspending, the driver must guarantee that no asynchronous transfers remain in flight to prevent memory corruption or use-after-free conditions. Introduce a 'spi_complete' slot tracking array in struct applespi_data to represent the two concurrent transfers (one for reads, one for writes). Implement applespi_async_outstanding() and applespi_async_complete() to track transfers under cmd_msg_lock. Set applespi->cancel_spi =3D true during drain operations to reject new asynchronous transfer requests with -ESHUTDOWN and activate completion tracking. In applespi_async_complete(), invoke the inner completion callback BEFORE clearing the tracking slot and waking waiters on wait_queue. This ensures that teardown threads waiting for in-flight transfers to drain cannot wake = up and free the driver structure before the completion callback finishes execu= tion, preventing use-after-free conditions. Signed-off-by: Shih-Yuan Lee --- drivers/input/keyboard/applespi.c | 75 +++++++++++++++++++++++++++++-- 1 file changed, 72 insertions(+), 3 deletions(-) diff --git a/drivers/input/keyboard/applespi.c b/drivers/input/keyboard/app= lespi.c index c501bf7e517e..c9bbceaf0671 100644 --- a/drivers/input/keyboard/applespi.c +++ b/drivers/input/keyboard/applespi.c @@ -421,6 +421,12 @@ struct applespi_data { bool read_active; bool write_active; =20 + struct applespi_complete_info { + void (*complete)(void *context); + struct applespi_data *applespi; + } spi_complete[2]; + bool cancel_spi; + struct work_struct work; struct touchpad_info_protocol rcvd_tp_info; =20 @@ -607,13 +613,73 @@ static void applespi_setup_write_txfrs(struct applesp= i_data *applespi) spi_message_add_tail(st_t, msg); } =20 +static bool applespi_async_outstanding(struct applespi_data *applespi) +{ + return applespi->spi_complete[0].complete || + applespi->spi_complete[1].complete; +} + +static void applespi_async_complete(void *context) +{ + struct applespi_complete_info *info =3D context; + struct applespi_data *applespi =3D info->applespi; + void (*complete)(void *context); + unsigned long flags; + + spin_lock_irqsave(&applespi->cmd_msg_lock, flags); + complete =3D info->complete; + spin_unlock_irqrestore(&applespi->cmd_msg_lock, flags); + + if (complete) + complete(applespi); + + spin_lock_irqsave(&applespi->cmd_msg_lock, flags); + info->complete =3D NULL; + + if (applespi->cancel_spi && !applespi_async_outstanding(applespi)) + wake_up_all(&applespi->wait_queue); + + spin_unlock_irqrestore(&applespi->cmd_msg_lock, flags); +} + static int applespi_async(struct applespi_data *applespi, struct spi_message *message, void (*complete)(void *)) { - message->complete =3D complete; - message->context =3D applespi; + struct applespi_complete_info *info; + int sts; + + assert_spin_locked(&applespi->cmd_msg_lock); + + if (applespi->cancel_spi) { + if (!applespi_async_outstanding(applespi)) + wake_up_all(&applespi->wait_queue); + return -ESHUTDOWN; + } + + /* + * There can only be at most 2 spi requests in flight, one for "reads" + * and one for "writes". + */ + if (!applespi->spi_complete[0].complete) + info =3D &applespi->spi_complete[0]; + else if (!applespi->spi_complete[1].complete) + info =3D &applespi->spi_complete[1]; + else { + dev_warn(&applespi->spi->dev, "Both SPI async slots in use\n"); + return -EBUSY; + } + + info->complete =3D complete; + info->applespi =3D applespi; =20 - return spi_async(applespi->spi, message); + message->complete =3D applespi_async_complete; + message->context =3D info; + + sts =3D spi_async(applespi->spi, message); + if (sts) + info->complete =3D NULL; + + return sts; } =20 static inline bool applespi_check_write_status(struct applespi_data *apple= spi, @@ -1799,6 +1865,7 @@ static void applespi_drain_writes(struct applespi_dat= a *applespi) spin_lock_irqsave(&applespi->cmd_msg_lock, flags); =20 applespi->drain =3D true; + applespi->cancel_spi =3D true; ret =3D wait_event_lock_irq_timeout(applespi->wait_queue, !applespi->write_active, applespi->cmd_msg_lock, @@ -1821,6 +1888,8 @@ static void applespi_drain_reads(struct applespi_data= *applespi) =20 spin_lock_irqsave(&applespi->cmd_msg_lock, flags); =20 + applespi->cancel_spi =3D true; + ret =3D wait_event_lock_irq_timeout(applespi->wait_queue, !applespi->read_active, applespi->cmd_msg_lock, --=20 2.39.5 From nobody Sat Jul 25 02:11:08 2026 Received: from mail-pj1-f46.google.com (mail-pj1-f46.google.com [209.85.216.46]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E52403ACEFF for ; Mon, 20 Jul 2026 16:22:31 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.46 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784564556; cv=none; b=sjVUgrQhWf50VITz8/5eikPx2vY3haWeWizO1xnfFvqAtmpT2xAxWepVt5Bmh885KmrE3n9TQRAhSB5w4+e3qTwn0KKX36gqrC8GvguAaxcL/nTkVTRZJ3MXO0SjIqejv6nRzexBCeNzNZsYdpxzaE8McqkT/yFjV5rfFXGW0Xk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784564556; c=relaxed/simple; bh=lMEL/guzYTtbgyFldhZtTjCpjd6NFbDQi30FdOkNlHU=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=l3aj8ldYLUK886g7RLu58Fa7wG5+y8v6mYc6f4hItoOj8cJ8SPmCelFEpX+9nno/uv8s6pJ6s9ESrVFVenEtILLTHe7v1Vc+fL0HSpuC31WW2KvDa8CtXm04NkQNxf4OHp/KMgj9XROdUIc/j/omNSGbQnd89wGzFClxvC4DWNY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=debian.org; spf=pass smtp.mailfrom=gmail.com; arc=none smtp.client-ip=209.85.216.46 Authentication-Results: smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=debian.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Received: by mail-pj1-f46.google.com with SMTP id 98e67ed59e1d1-38e041ea211so8163116a91.0 for ; Mon, 20 Jul 2026 09:22:31 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784564549; x=1785169349; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=4QSVvjgeOnTqjGkk31K3nbyNNkT3S+X+wqvMTCP4ZKo=; b=GgvHqzmEiO+YaUsJAlPh5kTymvgWWr9BbG/Yi36MxnImPHZrKjh20OwlInLildzIM/ XwtJB2QKR2hW76/+UeyucnDl7gym6KQUlG8sE7FrMAoFCxxLSCNUpScfL/r6mmiw3lOC u9vwWzIp1UZyv30s+vTMxByZhccd8JXaaNS3iuPNIG7Y0cFwNEPo1ebmhRW5sj0i1FrV 4kMo5e7UeWXOewx66vlmGhWgIZMqkLXi4OhadsbpWkyqFHMK2d0Iq9Ieu5HHz/uSERrQ EcTDDDbAHdIt7lCnvKbsDTK45soNcPmV2BFnptda+gnfhm8cVEzhAp6jAlHJtD2+/TgK /FPw== X-Forwarded-Encrypted: i=1; AHgh+RrCiljyUCL2KxTwBE4Nj6+GN+Z7th6E8Ft38QLCRtSKE1le9W+ph/cqv/n8hO4n3isOQfpS62i2Y9ZiHtk=@vger.kernel.org X-Gm-Message-State: AOJu0YyPIB2UqgWri5TbPbj18LDqTkMmhkM/zukWj5+I4giqVoaSlF5T UwUF0pspRLESQcAdiANYR2i9PxrF+IKEvKdwExA2YI6Hqp5HCA7ubjE= X-Gm-Gg: AR+sD10+SGeQWzL9vbRKRPaQP6tXvBQ3/hyTgsctWtcUEaIXm3HD3oAb8/Qszg6h0hU x11S0QvxzIREte21ReEz6ptvJb8tU+vjzn8VH0zE/aY8cPONcjSbJBH2iPrKJWUOiKGVAfZG6eX qX1xfEWt3wZOEEaPIvjKcHehrDYTGXCvSUisKa20hueVOWsA+viVpEAsvHiGs8SkcL1xayFZyU3 nw9xe5ZDMIRGIYuBtfkTEIGYXaveeyG4um2Y8mJERgYwAeMOOZbkZIdpJ7XG8QBMVEiYkmgVm8E w/rMDo6+pUIi3ayCkuGIEx4sUOeVrP9z9T8MXlki2kaogAzjA980+w+B6VJq0+3PPQc41DrwqUr Zk1cw6aeiW67VRih5+O4or1bDtmuxEJsSoiU1+DWI5derPHXOajmbDlgTxxaPGy7lbcs4qtcRY/ 3ypnyKgOI9Vi/lNi3+YLMol7RNkX+31BB1+M/Y5T6osErfeEq1sCsLFWWBu4g5pNF7VL5oyWwQd YVEZsLi+o/jQVHg2w== X-Received: by 2002:a17:90a:d646:b0:381:50ab:1594 with SMTP id 98e67ed59e1d1-38e4b51be59mr16272082a91.27.1784564549188; Mon, 20 Jul 2026 09:22:29 -0700 (PDT) Received: from penguin.tail0a1999.ts.net (61-228-16-100.dynamic-ip.hinet.net. [61.228.16.100]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-38e9205d358sm29366a91.3.2026.07.20.09.22.27 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 20 Jul 2026 09:22:28 -0700 (PDT) From: Shih-Yuan Lee To: Dmitry Torokhov Cc: Mark Brown , linux-input@vger.kernel.org, linux-kernel@vger.kernel.org, Shih-Yuan Lee Subject: [PATCH v3 3/5] Input: applespi - register touchpad synchronously in probe Date: Tue, 21 Jul 2026 00:22:17 +0800 Message-Id: <20260720162219.32324-4-fourdollars@debian.org> X-Mailer: git-send-email 2.39.5 In-Reply-To: <20260720162219.32324-1-fourdollars@debian.org> References: <20260720162219.32324-1-fourdollars@debian.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Replace the asynchronous worker for touchpad registration with synchronous registration during driver probe. Wait up to 3 seconds for the device info packet and fallback to keyboard-only mode if a timeout occurs. Prevent a kernel panic in debugfs by checking for a NULL touchpad_input_dev in applespi_tp_dim_open() before dereferencing it, returning -ENODEV if the device is operating in keyboard-only mode. Protect rcvd_tp_info from data races by creating a local copy under cmd_msg_lock before passing it to applespi_register_touchpad_device(). Signed-off-by: Shih-Yuan Lee --- drivers/input/keyboard/applespi.c | 60 ++++++++++++++++++++++--------- 1 file changed, 44 insertions(+), 16 deletions(-) diff --git a/drivers/input/keyboard/applespi.c b/drivers/input/keyboard/app= lespi.c index c9bbceaf0671..6db4eeca3060 100644 --- a/drivers/input/keyboard/applespi.c +++ b/drivers/input/keyboard/applespi.c @@ -427,7 +427,7 @@ struct applespi_data { } spi_complete[2]; bool cancel_spi; =20 - struct work_struct work; + bool have_tp_info; struct touchpad_info_protocol rcvd_tp_info; =20 struct dentry *debugfs_root; @@ -1030,6 +1030,9 @@ static int applespi_tp_dim_open(struct inode *inode, = struct file *file) { struct applespi_data *applespi =3D inode->i_private; =20 + if (!applespi->touchpad_input_dev) + return -ENODEV; + file->private_data =3D applespi; =20 snprintf(applespi->tp_dim_val, sizeof(applespi->tp_dim_val), @@ -1390,26 +1393,20 @@ applespi_register_touchpad_device(struct applespi_d= ata *applespi, return 0; } =20 -static void applespi_worker(struct work_struct *work) -{ - struct applespi_data *applespi =3D - container_of(work, struct applespi_data, work); - - applespi_register_touchpad_device(applespi, &applespi->rcvd_tp_info); -} - static void applespi_handle_cmd_response(struct applespi_data *applespi, struct spi_packet *packet, struct message *message) { + unsigned long flags; + if (packet->device =3D=3D PACKET_DEV_INFO && le16_to_cpu(message->type) =3D=3D 0x1020) { - /* - * We're not allowed to sleep here, but registering an input - * device can sleep. - */ + spin_lock_irqsave(&applespi->cmd_msg_lock, flags); applespi->rcvd_tp_info =3D message->tp_info; - schedule_work(&applespi->work); + applespi->have_tp_info =3D true; + spin_unlock_irqrestore(&applespi->cmd_msg_lock, flags); + + wake_up_all(&applespi->wait_queue); return; } =20 @@ -1677,6 +1674,7 @@ static int applespi_probe(struct spi_device *spi) acpi_handle spi_handle =3D ACPI_HANDLE(&spi->dev); acpi_status acpi_sts; int sts, i; + unsigned long flags; unsigned long long gpe, usb_status; =20 /* check if the USB interface is present and enabled already */ @@ -1694,8 +1692,6 @@ static int applespi_probe(struct spi_device *spi) =20 applespi->spi =3D spi; =20 - INIT_WORK(&applespi->work, applespi_worker); - /* store the driver data */ spi_set_drvdata(spi, applespi); =20 @@ -1823,6 +1819,25 @@ static int applespi_probe(struct spi_device *spi) /* trigger touchpad setup */ applespi_init(applespi, false); =20 + /* set up the touchpad as a separate input device if info is received */ + sts =3D wait_event_timeout(applespi->wait_queue, + READ_ONCE(applespi->have_tp_info), + msecs_to_jiffies(3000)); + if (!sts) { + dev_warn(&applespi->spi->dev, + "Timed out waiting for touchpad info, continuing keyboard-only\n"); + } else { + struct touchpad_info_protocol tp_info; + + spin_lock_irqsave(&applespi->cmd_msg_lock, flags); + tp_info =3D applespi->rcvd_tp_info; + spin_unlock_irqrestore(&applespi->cmd_msg_lock, flags); + + sts =3D applespi_register_touchpad_device(applespi, &tp_info); + if (sts) + goto cancel_spi; + } + /* * By default this device is not enabled for wakeup; but USB keyboards * generally are, so the expectation is that by default the keyboard @@ -1855,6 +1870,19 @@ static int applespi_probe(struct spi_device *spi) &applespi_tp_dim_fops); =20 return 0; + +cancel_spi: + acpi_disable_gpe(NULL, applespi->gpe); + acpi_remove_gpe_handler(NULL, applespi->gpe, applespi_notify); + + spin_lock_irqsave(&applespi->cmd_msg_lock, flags); + applespi->cancel_spi =3D true; + wait_event_lock_irq(applespi->wait_queue, + !applespi_async_outstanding(applespi), + applespi->cmd_msg_lock); + spin_unlock_irqrestore(&applespi->cmd_msg_lock, flags); + + return sts; } =20 static void applespi_drain_writes(struct applespi_data *applespi) --=20 2.39.5 From nobody Sat Jul 25 02:11:08 2026 Received: from mail-pj1-f54.google.com (mail-pj1-f54.google.com [209.85.216.54]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A6D5E434E32 for ; Mon, 20 Jul 2026 16:22:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.54 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784564561; cv=none; b=rhRaSGbPU9DlKS67RmQXkcGw5YNFgkaCRsMiB1vRB9Yp+EpE89qNsNQLVsw91yAAwFVC6soPLoxn+SP61KsOe+UTp6rcdlNLE98WHhdIpMutO8+IoTD6fgK4P9xiD24zr4DxoGBf5jTFONlbXBbC6U4J1vWmfxXwfcKYJIc2UCU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784564561; c=relaxed/simple; bh=9pB2UASsNT6tRLrddKLGk3chBzvFw90R7Bm4zhenDzE=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=T0PIcWAi9+qyG4WtgNZGWuaN51o4bOiz6b6QZv3giriIG4AlxBJ7rc1rBgbgvOBm8/tTuQA3HIcwoJ5bXc/VHTRXdZwCgO2xOHGbuksEiQXlFFNLEPinAWdfY+0JEPhVoGgM17tL8E6n1mQmM5d9UG1SSmMLiPFxir717ToKL9E= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=debian.org; spf=pass smtp.mailfrom=gmail.com; arc=none smtp.client-ip=209.85.216.54 Authentication-Results: smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=debian.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Received: by mail-pj1-f54.google.com with SMTP id 98e67ed59e1d1-38e07ebd263so4498003a91.1 for ; Mon, 20 Jul 2026 09:22:35 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784564551; x=1785169351; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=iIWbRQOsRBXbHQl+Eokek9JB8ruZxyWntLUXaYunpkA=; b=fHL4xW2/XsqK/jy1JlJC9JeLpM1lKz8Q3Wnth0jERJ/F0TlNmx/nL7apfH/IopGWWw m5olHPFj199STqrzGDQNA3+Lj2NWx3wP1JYkLRXONtxWQzMQTynfFT58B6A/ujqsyP6P T8AGZlRwoj7aIKN2zrhk6ELKauDihPoXpJKKLHke+LItA8YxRP7jumdJOQ+sRf1jh7Id wnXvybboxboqpkqLjHRAh7NL3D/F6mR5A/rvau4Pi6y7C4AOYL6X+61zD2jinrzcF2Gi uyGgsjZ6Fs7uwnGOU/XIw1jAy1rkAyqYOL/N4upd12enBrwBmNM4p7YWPz9C3yDQO8sE cl0A== X-Forwarded-Encrypted: i=1; AHgh+Rol/CsvojNubiMc6coK1bHfzvShlxACQETQBQQjMbfUEq+UL1qIvRhW0w27lcbKh/xe7f0mLtJZlN8r/J0=@vger.kernel.org X-Gm-Message-State: AOJu0YygTNoxfPRaKGljG0Pt7uQ2YI9qZ4tOAFLDIjArxB8/M8iZMwmp JTgdnqdiEI8MSYiyQDQRjVoRldZCUk0QyZ//1u9kYX16E9NFXBqBjTM= X-Gm-Gg: AR+sD13T1oF3poc6EoxSi8rXiT0z/WZ4aQocvV/Jf140ot3B11W2YZEcDj3zsyn2aoO T8T6L2lD9/ov1F2Ld+fu3/z7e6tJj+cuSlt9pH0orPCM0WDxXqIJf90S8f4mgGOtlmXJkoea57t ChXQiQAc4CRT+kHPecsfwXRJkJTXg0dPqyZhOFvxsNe7SAQJsPhvWcbz8jWfLjW2Q0WwXnrTXfT HBZLJLeMAMCyXWqPEI+5YCYswLEw5QFvXhZUgFbspJb7MaMgrIksrQ+nPenFS2VwR3J7s6U5GuU ZzGRvtmLouNJicz6rVyjjsR/Jomr/Idu0hFZYIDpDDWCpxP3TXcq/KIFL0CCJFei5l8HGr2AWj9 j4UXVPopxFzh890ccy5V/6pliEAzzyZLQDDjBz3PzShmtzrklyg5TbLBVQEAnMBwGjUnnNMfYKF BhjdrxdsqqmWZcMnJ8qviUiIu8+vE5vonKi5lsZzSgEYLOz7G1VaBmJ4xwwSQSWPiFHy3R5qY4Y cGPIJSPorAX/WdBEg== X-Received: by 2002:a17:90b:2151:b0:38e:59c2:cbc5 with SMTP id 98e67ed59e1d1-38e59c2dc76mr8159002a91.18.1784564550787; Mon, 20 Jul 2026 09:22:30 -0700 (PDT) Received: from penguin.tail0a1999.ts.net (61-228-16-100.dynamic-ip.hinet.net. [61.228.16.100]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-38e9205d358sm29366a91.3.2026.07.20.09.22.29 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 20 Jul 2026 09:22:30 -0700 (PDT) From: Shih-Yuan Lee To: Dmitry Torokhov Cc: Mark Brown , linux-input@vger.kernel.org, linux-kernel@vger.kernel.org, Shih-Yuan Lee Subject: [PATCH v3 4/5] Input: applespi - prefer asynchronous driver probing Date: Tue, 21 Jul 2026 00:22:18 +0800 Message-Id: <20260720162219.32324-5-fourdollars@debian.org> X-Mailer: git-send-email 2.39.5 In-Reply-To: <20260720162219.32324-1-fourdollars@debian.org> References: <20260720162219.32324-1-fourdollars@debian.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Set probe_type to PROBE_PREFER_ASYNCHRONOUS to allow the driver core to run applespi_probe() asynchronously. This improves system boot speeds by avoiding blocking the main kernel thread during the 3-second touchpad detection wait. Additionally, clean up applespi_tp_dim_open() by simplifying product ID retrieval and avoiding dereferencing touchpad_input_dev without a helper variable. Signed-off-by: Shih-Yuan Lee --- drivers/input/keyboard/applespi.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/input/keyboard/applespi.c b/drivers/input/keyboard/app= lespi.c index 6db4eeca3060..a21e89f30387 100644 --- a/drivers/input/keyboard/applespi.c +++ b/drivers/input/keyboard/applespi.c @@ -1029,6 +1029,7 @@ static void applespi_debug_update_dimensions(struct a= pplespi_data *applespi, static int applespi_tp_dim_open(struct inode *inode, struct file *file) { struct applespi_data *applespi =3D inode->i_private; + struct input_dev *touchpad =3D applespi->touchpad_input_dev; =20 if (!applespi->touchpad_input_dev) return -ENODEV; @@ -1037,7 +1038,7 @@ static int applespi_tp_dim_open(struct inode *inode, = struct file *file) =20 snprintf(applespi->tp_dim_val, sizeof(applespi->tp_dim_val), "0x%.4x %dx%d+%u+%u\n", - applespi->touchpad_input_dev->id.product, + touchpad->id.product, applespi->tp_dim_min_x, applespi->tp_dim_min_y, applespi->tp_dim_max_x - applespi->tp_dim_min_x, applespi->tp_dim_max_y - applespi->tp_dim_min_y); @@ -2044,6 +2045,7 @@ static struct spi_driver applespi_driver =3D { .name =3D "applespi", .acpi_match_table =3D applespi_acpi_match, .pm =3D pm_sleep_ptr(&applespi_pm_ops), + .probe_type =3D PROBE_PREFER_ASYNCHRONOUS, }, .probe =3D applespi_probe, .remove =3D applespi_remove, --=20 2.39.5 From nobody Sat Jul 25 02:11:08 2026 Received: from mail-pj1-f41.google.com (mail-pj1-f41.google.com [209.85.216.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4E23743E077 for ; Mon, 20 Jul 2026 16:22:36 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.41 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784564560; cv=none; b=uWZo+TfbQGwnvrfdeyKtTN2Ck5IBxRI/4gU5I5o+G27WCqGXqNomg5vUvURdNuFzmIo+ZgrYXmjC9QQRUPf9nZRgJziOEFtJatY5bU8CeTMqguC+qGkQ/HYcWloLAhOIcGNf01xH1ErbSnVKBNDwCxP/kuWnkjk/0JujhVdT3K0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784564560; c=relaxed/simple; bh=V6U73O55j87WWMKBgA3iBdB1uBtOCakg5nSbkbbd0Zk=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=PKph4nqLvjAhKPt108JmpbGdD6LG6+WiwobEhUU8nRdFzNSpZx2v+Zpkr1ZVdMndNz/73I0cYqvCpKfc/sTGhD3r+luqM33r1sADFg+DKfRZIma6BPehLekhRnYgHJcKCgq9+GU0gjMy8Qw2+Iddq/vKDoslO7pZrxank9yj9tI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=debian.org; spf=pass smtp.mailfrom=gmail.com; arc=none smtp.client-ip=209.85.216.41 Authentication-Results: smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=debian.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Received: by mail-pj1-f41.google.com with SMTP id 98e67ed59e1d1-38e08baf860so7899512a91.2 for ; Mon, 20 Jul 2026 09:22:35 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784564552; x=1785169352; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=bqJobqE4ILhTlySWbCodoBRjay5MfDN8IuFjxNUP+Sc=; b=mbnHaS6b78PZeD7fsD9nUIERvPw23lGh3zeLvP97WvYg7yYKSo/nArzWaofuULWxbq gdZOC/ZVYIVWiStJlfqmFO/3ZK6/a4iQKu0dL9pSahw0MJOCJ+LCSuEqLvBtO0sxkR27 KIXDyLjIBLoPDy/aksxGKfhoBPEsJ5nq7fPg5/6A8HnOeM0e9klkD0j8C+e9CPQkvy8X Fpfpl62RhVs1lQg6/jQZAhDBhy5PCiwTBeEdTPfNCzdMjAeJJOVkiWN/yQ0co2spD37j Iu3lj7h4X+1kyTNNjTeIOdxSBX3GZkCDSzJ9PROhDK1RYVhJj2wQWLnhf04U3qu8qfRp 4HMA== X-Forwarded-Encrypted: i=1; AHgh+Ro09qf6oOhXqTls8kjC6WFkYUGfN4kE2By27SmK7YWvEuJBDhE/rvk32kDVb4p8clmCsyRWrbH9skj52VM=@vger.kernel.org X-Gm-Message-State: AOJu0Yw/a6vm36h9nlGnFbglXBvbauYr8YBYNHrLveEm7RN419tg1j0A OkAG6W6L3PvZAoWXPcUEQdFSLt2oOW9dYQFyGmmdM8cWlH02MRHHmHAnkpiRb0lxLw== X-Gm-Gg: AR+sD13c3jNCpUzX1Xd9l/5xYTtpF0hSfnmMZuiDs4lca/JQzMjNnIbcx08jtUYjNKo L7cCwwKzk0RdQ6z7RAWHIT2BmaEuWLLcrvQ5hGeB4Pe1F7IRBRA4ZUkdeVEhFS5Z3kh4oWbpQ4N NCIq3n2YtYr9psnH6vYIZukRZpcg9foVULk6n8cHesHLMrtjyzhmgZpDFjeDz9z3+Nrxsn18G4e GSfVAJNa/JQmMcrXYfyh6e4Tx6VIbShN5xKK2zm4YWk6Sb1Aphb5sqNdUVrfeoO70pWbkrjHXFJ Ut4lN306BGQyStUZSKPxAL/+gfdwJEa7XrOJRirufMv0YNMumlavX5A8TtRIMJh50rVXYxY5cqL FvOL53B6dNYdKbnXXZXEvGxtBVFIoVHWPnGRU/N3ZrRm48cxrI8KZqnPBGsVc/IzZCDr+gb6I6y W9jRJxfXgkjgcfc0dw5OeoSnX3Idhmd//XkzhYGN7xY4uorEIlNTPkZ2m9G9n9dN1+dtFtQq6Wf 30XnVyjolK9DcioLQ== X-Received: by 2002:a17:90b:57c5:b0:38e:2860:253f with SMTP id 98e67ed59e1d1-38e4b447cd5mr15478935a91.12.1784564552370; Mon, 20 Jul 2026 09:22:32 -0700 (PDT) Received: from penguin.tail0a1999.ts.net (61-228-16-100.dynamic-ip.hinet.net. [61.228.16.100]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-38e9205d358sm29366a91.3.2026.07.20.09.22.31 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 20 Jul 2026 09:22:32 -0700 (PDT) From: Shih-Yuan Lee To: Dmitry Torokhov Cc: Mark Brown , linux-input@vger.kernel.org, linux-kernel@vger.kernel.org, Shih-Yuan Lee Subject: [PATCH v3 5/5] Input: applespi - fix use-after-free in applespi_remove() Date: Tue, 21 Jul 2026 00:22:19 +0800 Message-Id: <20260720162219.32324-6-fourdollars@debian.org> X-Mailer: git-send-email 2.39.5 In-Reply-To: <20260720162219.32324-1-fourdollars@debian.org> References: <20260720162219.32324-1-fourdollars@debian.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Replace the separate read and write drain helpers with a single barrier usi= ng cancel_spi and wait_event_lock_irq_timeout(). Wait for outstanding asynchro= nous SPI operations to complete before tearing down the driver context. Disable GPE and remove the GPE handler prior to setting cancel_spi =3D true. This prevents level-triggered GPE interrupt storms where applespi_notify() repeatedly attempts applespi_async() and gets rejected with -ESHUTDOWN while the hardware interrupt line remains asserted. If the 3-second wait times out while SPI transfers are still outstanding, i= ssue a warning and fallback to waiting unconditionally until all transfers compl= ete, guaranteeing that applespi_remove() never returns prematurely while transfe= rs are active. Signed-off-by: Shih-Yuan Lee --- drivers/input/keyboard/applespi.c | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-) diff --git a/drivers/input/keyboard/applespi.c b/drivers/input/keyboard/app= lespi.c index a21e89f30387..602780842124 100644 --- a/drivers/input/keyboard/applespi.c +++ b/drivers/input/keyboard/applespi.c @@ -1939,14 +1939,29 @@ static void applespi_drain_reads(struct applespi_da= ta *applespi) static void applespi_remove(struct spi_device *spi) { struct applespi_data *applespi =3D spi_get_drvdata(spi); + unsigned long flags; + long ret; =20 - applespi_drain_writes(applespi); - + /* Disable GPE and remove handler first to prevent interrupt storm */ acpi_disable_gpe(NULL, applespi->gpe); acpi_remove_gpe_handler(NULL, applespi->gpe, applespi_notify); device_wakeup_disable(&spi->dev); =20 - applespi_drain_reads(applespi); + /* Prevent any new SPI transfers and wait for outstanding ones */ + spin_lock_irqsave(&applespi->cmd_msg_lock, flags); + applespi->cancel_spi =3D true; + ret =3D wait_event_lock_irq_timeout(applespi->wait_queue, + !applespi_async_outstanding(applespi), + applespi->cmd_msg_lock, + msecs_to_jiffies(3000)); + if (!ret && applespi_async_outstanding(applespi)) { + dev_warn(&applespi->spi->dev, + "Timed out waiting for SPI transfers to drain, waiting unconditionally= \n"); + wait_event_lock_irq(applespi->wait_queue, + !applespi_async_outstanding(applespi), + applespi->cmd_msg_lock); + } + spin_unlock_irqrestore(&applespi->cmd_msg_lock, flags); =20 debugfs_remove_recursive(applespi->debugfs_root); } --=20 2.39.5